geenforce: harden allowlist + fix share-less kiosk client and display scope

- allowlist auth uses remote_addr, not the spoofable first X-Forwarded-For hop
  (adds _trusted_client_ip + a regression test); rate-limit path unchanged
- client psm1: fix Set-StrictMode crashes reading absent keys in Get-ShopdbConfig
  (token-less mode) and Resolve-ShopdbPayloads (no-payload entries); validate
  the manifest response is JSON before overwriting the last-known-good cache
- runner: pass the engine its required -InstallerRoot/-LogFile; create the log
  directory so enforce logging is not silently lost on a fresh kiosk
- display scope: dispatcher writes an all-users Startup shortcut instead of
  Start-Process (SYSTEM cannot show a window in session 0), resolves the base
  URL from HKLM, and adds an always-on power/no-lock entry; tests updated for
  the 6-entry scope

plugins/geenforce/client/Invoke-ShopdbEnforce.ps1

@@ -55,7 +55,13 @@ param(
 function Write-Log {
     param([string]$Message, [string]$Level = 'INFO')
     $line = "$(Get-Date -Format 'yyyy-MM-dd HH:mm:ss') [$Level] $Message"
-    try { Add-Content -LiteralPath $LogFile -Value $line -ErrorAction SilentlyContinue } catch {}
+    try {
+        $logDir = Split-Path -Parent $LogFile
+        if ($logDir -and -not (Test-Path $logDir)) {
+            New-Item -ItemType Directory -Path $logDir -Force -ErrorAction SilentlyContinue | Out-Null
+        }
+        Add-Content -LiteralPath $LogFile -Value $line -ErrorAction SilentlyContinue
+    } catch {}
     Write-Host $line
 }
 
@@ -164,8 +170,23 @@ try {
     # code, or emit several objects. ConvertTo-ShopdbSummary adapts whatever it
     # returns into a well-formed summary hashtable so the report stage always
     # gets clean input (we do NOT assume the engine was fixed).
+    # The engine requires -InstallerRoot (base for any relative Source/Installer
+    # path) and -LogFile. Shadow runs off the share, so relative paths resolve
+    # against the share scope dir. Cutover rewrites payloads to ABSOLUTE local
+    # paths, so InstallerRoot is only a harmless fallback base (the payload cache).
+    if ($ShadowMode -and $ShareManifestPath) {
+        $installerRoot = Split-Path -Parent $ShareManifestPath
+    } else {
+        $installerRoot = Join-Path (Split-Path -Parent $manifestToRun) 'payloads'
+    }
+    if ($installerRoot -and -not (Test-Path $installerRoot)) {
+        New-Item -ItemType Directory -Path $installerRoot -Force -ErrorAction SilentlyContinue | Out-Null
+    }
+    $engineLog = $LogFile -replace '\.log$', '-engine.log'
+
     Write-Log "Running engine against $manifestToRun"
-    $engineResult = & $EnginePath -ManifestPath $manifestToRun -PCType $Scope
+    $engineResult = & $EnginePath -ManifestPath $manifestToRun -PCType $Scope `
+        -InstallerRoot $installerRoot -LogFile $engineLog
     $summary = ConvertTo-ShopdbSummary -EngineResult $engineResult
 
     # Report the result (best-effort).